Azure Question posted in
The official documentation to get you started can be found here.

Azure – App Registration permission to create other App Registrations

We already create almost all our Azure resources via ARM / Bicep Templates from Azure DevOps. In an effort to minimize scripted / hand-on-keyboard resources I would like to be able to create new App Registrations from Azure DevOps pipelines.

I have a bicep file that works when deployed from my local machine, but fails when deployed via pipeline with the error:

Insufficient privileges to complete the operation. Graph client request id: 5338m403-886c-43d3-9994-e77bedd0ee20. Graph request timestamp: 2024-10-16T09:47:26Z

The Service Connection uses an App Registration with federated credentials and successfully creates other resources within the subscription.

Within Entra the Service Principal has been granted both the "Application Developer" and "Cloud Application Administrator" roles.

The relevant section of the Bicep file looks like this:

resource clientApp 'Microsoft.Graph/[email protected]' = {
  uniqueName: '${uniquesuffix}'
  displayName: uiAppRegName
  signInAudience: 'AzureADandPersonalMicrosoftAccount'  
  web: {
    redirectUris:[
      'https://localhost:5001/signin-oidc'
      'https://${uiWebAppName}.azurewebsites.net/signin-oidc'
    ]    
    implicitGrantSettings: {
      enableIdTokenIssuance: true
    }    
  }
  passwordCredentials: [
    {displayName: 'bicep generated secret key'}
  ]
}

resource clientSp 'Microsoft.Graph/[email protected]' = {
  appId: clientApp.appId  
}

What am I missing here

Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    Turns out that what I needed was to add the API Permission of the App Registration to Application.ReadWrite.All and have my Entra admin apply Global Consent


  2. 0

    I can reproduce the same error when only assign the App Registration of the service connection with "Cloud Application Administrator" role.

    enter image description here

    Solution:

    Assign the App Registration of the service connection with "Application Administrator" role.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search